Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)

Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

Chartbrew: Remote Code Execution (RCE) via Vulnerable API

Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id

Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks

Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`

Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)

Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle

Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks

Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions

Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override

Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew

Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations

Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API